I don't think anyone is suggesting that you should compromise your security to enable auto-updating. Automatic updates are never better than correct file permis

I don't think anyone is suggesting that you should compromise your security to enable auto-updating. Automatic updates are never better than correct file permissions. The point here is that a large number of WordPress sites are running with file permissions such that the web server can write to the web root. By trying to auto update, those sites with poor file permissions get a minor security benefit (shorter time between patch release and patch application) while all of the installations running with safe file permissions are entirely unaffected. There's no downside to a secure site having the automatic update code. There's a small upside to an insecure site having it.